erroneo.us
Search all guides⌘K

Security Digest · Sep 22, 2026 · Malicious package · Library

Graphalgo Malware in Go Modules and Terraform Providers

Two Go modules and two Terraform providers, including a kreuzwerker/docker typosquat, hid a Go RAT. Check go.mod and .tf files; reimage hosts that ran them.

Published By erroneo.us Security Desk · Updated 3 min read5 sources

Our verdict

Check exposure

Grep your go.mod, go.sum and Terraform files for four names; if none match you are done, and if one does, treat the machine as compromised.

Who must act: Go developers and infrastructure teams who added gocommunity.io/orderedbtree, gogets.dev/btreex, or the kreuzwenker/docker or gocommunity-io/dockerd Terraform providers, including through a coding task or sample repository someone sent them.

Who can relax: Teams whose dependency files contain none of the four names, and Terraform users whose lock files reference the genuine kreuzwerker/docker provider.

Affected
gocommunity.io/orderedbtree (all versions; first published Aug 11, 2026)
gogets.dev/btreex (all versions; first published Sep 8, 2026)
Terraform provider kreuzwenker/docker (one-letter typosquat of kreuzwerker/docker)
Terraform provider gocommunity-io/dockerd (published early September 2026)
Fixed in
No fixed versions: remove the packages
proxy.golang.org refuses to serve both Go modules (checked Oct 21, 2026)
Terraform Registry returns 'provider not found' for both providers (checked Oct 21, 2026)
CVSS
Not scored
EPSS
n/a
CISA KEV
Not listed
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Search Go projects: grep -rnE 'gogets\.dev/btreex|gocommunity\.io/orderedbtree' --include=go.mod --include=go.sum .
  2. Search Terraform code and lock files: grep -rnE 'kreuzwenker/docker|gocommunity-io/dockerd' --include='*.tf' --include='.terraform.lock.hcl' .
  3. Fix the provider source to kreuzwerker/docker and run terraform init -upgrade.
  4. If a match ran anywhere, isolate and reimage the host, then rotate every credential it could reach, cloud and infrastructure credentials first.
  5. Review commits, package publishes, terraform apply runs and CI jobs from that host for unauthorized activity.

How to check if you are affected or compromised

  • Look for examples/resources/docker_container/import-resource.sqlite3 (SHA-256 5f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0f) in provider caches, and btreex.sql (SHA-256 ab01686d87565250fc4989faddb877d793667b07ec217a61cbd798f5695d62f5) in the Go module cache.
  • Check for detached 'go run .' processes started by terraform or by test runs.
  • Alert on build or developer hosts talking to Slack workspaces portfolio-devs or portfolio-testers, or polling Arbitrum Sepolia contract 0xAD02b5cDE693529d3bdA0266299501ad0193036C.
  • Search DNS logs for gocommunity.io and gogets.dev.

What happened#

On September 22, 2026, Aikido Security reported four malicious packages carrying a Go port of the Graphalgo malware. There were two Go modules, gocommunity.io/orderedbtree and gogets.dev/btreex, and two Terraform providers, gocommunity-io/dockerd and kreuzwenker/docker. The last is a one-letter typosquat of kreuzwerker/docker, the widely used Docker provider that Aikido says has 56 million reported downloads. The samples share blockchain and Slack infrastructure and a public key with earlier npm samples. ReversingLabs first documented Graphalgo in February 2026. It described the campaign as fake recruiters handing developers coding tasks that pull in malicious npm and PyPI dependencies, and attributed it to Lazarus Group based on technique similarity.

The payloads hide behind triggers. In the Terraform providers, code in resource_docker_container_funcs.go activates only when the SHA-256 of the container name and network ID matches a fixed value, which then serves as an AES key. It decrypts an archive disguised as import-resource.sqlite3 and runs it with a detached go run .. The Go modules fire on a specific "price" integer, and btreex hides its archive in a file named btreex.sql. The second stage is a Go remote access trojan. It checks in with host and user details, takes commands over Slack and over an Ethereum contract on Arbitrum Sepolia, and can run Go or JavaScript code or delete itself.

Who is affected#

Only projects that pulled one of the four names. gocommunity.io/orderedbtree was first published on August 11 and gogets.dev/btreex on September 8. The second came with forged commits backdated to November 2025 so the repository looked established. Download counts for the malicious packages were not disclosed as of October 21, 2026. OSV lists both modules as malicious in MAL-2026-17454 and MAL-2026-17453. On October 21, proxy.golang.org refused to serve either module, flagging both as malicious, and the Terraform Registry returned "provider not found" for both providers.

Do you really need to act?#

Most teams need one grep and nothing else. Because of the triggers, a casual install may never fire. The payload waits for a repository or Terraform config that supplies the unlocking values. That fits Graphalgo's fake-interview playbook, though Aikido did not say how these packages reached victims. If a candidate exercise, take-home task or "sample infrastructure" repository reached you in August or September, check it. A hit on a machine with cloud or Terraform credentials is serious, because the attacker gets a live remote shell next to your infrastructure keys.

The Go proxy block protects you only if you fetch through proxy.golang.org. With GOPROXY=direct, or a private mirror that cached the modules earlier, they may still resolve.

What to do now#

  1. Go: grep -rnE 'gogets\.dev/btreex|gocommunity\.io/orderedbtree' --include=go.mod --include=go.sum . across your repositories, and purge the names from any internal module mirror.
  2. Terraform: grep -rnE 'kreuzwenker/docker|gocommunity-io/dockerd' --include='*.tf' --include='.terraform.lock.hcl' .. Correct the required_providers source to kreuzwerker/docker and run terraform init -upgrade.
  3. On any match that ran, isolate and reimage the host. The command-and-control channels may still reach it.
  4. Rotate every credential the host could read, starting with cloud and Terraform credentials. Then review its commits, publishes, terraform apply runs and CI jobs.
  5. Where build hosts have no business talking to blockchain RPC services or Slack, alert on that traffic.

How to tell if you were hit#

Search provider caches (.terraform/providers, ~/.terraform.d/plugins) for import-resource.sqlite3 with SHA-256 5f892a54…977d0f. Search the Go module cache ($(go env GOMODCACHE)) for btreex.sql with SHA-256 ab01686d…5d62f5. Look for detached go run . processes spawned by terraform or test runs. Check DNS and proxy logs for gocommunity.io, gogets.dev, the Slack workspaces portfolio-devs and portfolio-testers, and calls to Arbitrum Sepolia contract 0xAD02b5cDE693529d3bdA0266299501ad0193036C.

Timeline#

  • — ReversingLabs documents the Graphalgo fake-recruiter campaign on npm and PyPI.
  • — gocommunity.io/orderedbtree is first published.
  • — gogets.dev/btreex is first published. The gocommunity-io/dockerd provider appears in early September.
  • — Aikido publishes its research, updated Sep 24.
  • — OSV publishes MAL-2026-17453 and MAL-2026-17454.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Aikido Security — Graphalgo campaign spreads to Terraform providers and Go modules aikido.dev
  2. OSV — MAL-2026-17454: Malicious code in gogets.dev/btreex osv.dev
  3. OSV — MAL-2026-17453: Malicious code in gocommunity.io/orderedbtree osv.dev
  4. Terraform Registry — kreuzwerker/docker (genuine provider) registry.terraform.io
  5. ReversingLabs — Fake recruiter campaign targets crypto devs (Graphalgo) reversinglabs.com